Bugzilla Multiple Security Vulnerabilities
BID:49042
Info
Bugzilla Multiple Security Vulnerabilities
| Bugtraq ID: | 49042 |
| Class: | Unknown |
| CVE: |
CVE-2011-2379 CVE-2011-2380 CVE-2011-2381 CVE-2011-2976 CVE-2011-2977 CVE-2011-2978 CVE-2011-2979 |
| Remote: | Yes |
| Local: | Yes |
| Published: | Aug 05 2011 12:00AM |
| Updated: | May 07 2015 05:06PM |
| Credit: | Frédéric Buclin, Byron Jones, Max Kanat-Alexander, Reed Loden, Neal Poole, Neil Rashbrook, David Lawrence |
| Vulnerable: |
Mozilla Bugzilla 3.7.2 Mozilla Bugzilla 3.7.1 Mozilla Bugzilla 3.6.4 Mozilla Bugzilla 3.6.1 Mozilla Bugzilla 3.5.3 Mozilla Bugzilla 3.5.2 Mozilla Bugzilla 3.5.1 Mozilla Bugzilla 3.4.10 Mozilla Bugzilla 3.4.1 Mozilla Bugzilla 3.3.4 Mozilla Bugzilla 3.3.3 Mozilla Bugzilla 3.3.2 Mozilla Bugzilla 3.3.1 Mozilla Bugzilla 3.2.10 Mozilla Bugzilla 3.2.7 Mozilla Bugzilla 3.2.6 Mozilla Bugzilla 3.2.5 Mozilla Bugzilla 3.2.4 Mozilla Bugzilla 3.2.3 Mozilla Bugzilla 3.2.2 Mozilla Bugzilla 3.2.1 Mozilla Bugzilla 3.1.4 Mozilla Bugzilla 3.1.3 Mozilla Bugzilla 3.1.2 Mozilla Bugzilla 3.1.1 Mozilla Bugzilla 3.1 Mozilla Bugzilla 3.0.11 Mozilla Bugzilla 3.0.10 Mozilla Bugzilla 3.0.9 Mozilla Bugzilla 3.0.8 Mozilla Bugzilla 3.0.7 Mozilla Bugzilla 3.0.6 Mozilla Bugzilla 3.0.5 Mozilla Bugzilla 3.0.4 Mozilla Bugzilla 3.0.2 Mozilla Bugzilla 3.0.1 Mozilla Bugzilla 3.0 Mozilla Bugzilla 2.23.4 Mozilla Bugzilla 2.23.3 Mozilla Bugzilla 2.23.2 Mozilla Bugzilla 2.22.7 Mozilla Bugzilla 2.22.6 Mozilla Bugzilla 2.22.5 Mozilla Bugzilla 2.22.4 Mozilla Bugzilla 2.22.3 Mozilla Bugzilla 2.22.2 Mozilla Bugzilla 2.22.1 Mozilla Bugzilla 2.21.2 Mozilla Bugzilla 2.21.1 Mozilla Bugzilla 2.21 Mozilla Bugzilla 2.20.7 Mozilla Bugzilla 2.20.6 Mozilla Bugzilla 2.20.5 Mozilla Bugzilla 2.20.4 Mozilla Bugzilla 2.20.3 Mozilla Bugzilla 2.20.2 Mozilla Bugzilla 2.20.1 Mozilla Bugzilla 2.20 rc2 Mozilla Bugzilla 2.20 rc1 Mozilla Bugzilla 2.19.3 Mozilla Bugzilla 2.19.2 Mozilla Bugzilla 2.19.1 Mozilla Bugzilla 2.19 Mozilla Bugzilla 2.18.6 Mozilla Bugzilla 2.18.5 Mozilla Bugzilla 2.18.4 Mozilla Bugzilla 2.18.3 Mozilla Bugzilla 2.18.2 Mozilla Bugzilla 2.18.1 Mozilla Bugzilla 2.18 rc3 Mozilla Bugzilla 2.18 rc2 Mozilla Bugzilla 2.18 rc1 Mozilla Bugzilla 2.17.7 Mozilla Bugzilla 2.17.6 Mozilla Bugzilla 2.17.5 Mozilla Bugzilla 2.17.4 Mozilla Bugzilla 2.17.3 Mozilla Bugzilla 2.17.2 Mozilla Bugzilla 2.17.1 Mozilla Bugzilla 2.17 Mozilla Bugzilla 2.16.11 Mozilla Bugzilla 2.16.10 Mozilla Bugzilla 2.16.9 Mozilla Bugzilla 2.16.8 Mozilla Bugzilla 2.16.7 Mozilla Bugzilla 2.16.6 Mozilla Bugzilla 2.16.5 Mozilla Bugzilla 2.16.4 Mozilla Bugzilla 2.16.3 Mozilla Bugzilla 2.16.2 Mozilla Bugzilla 2.16.1 Mozilla Bugzilla 2.16 .10 Mozilla Bugzilla 2.16 Mozilla Bugzilla 2.14.5 Mozilla Bugzilla 2.14.4 Mozilla Bugzilla 2.14.3 Mozilla Bugzilla 2.14.2 Mozilla Bugzilla 2.14.1 Mozilla Bugzilla 2.14 Mozilla Bugzilla 2.12 Mozilla Bugzilla 2.10 Mozilla Bugzilla 2.9 Mozilla Bugzilla 2.8 Mozilla Bugzilla 2.6 Mozilla Bugzilla 2.4 Mozilla Bugzilla 4.1 Mozilla Bugzilla 4.0rc2 Mozilla Bugzilla 4.0rc1 Mozilla Bugzilla 3.7.3 Mozilla Bugzilla 3.7.2 Mozilla Bugzilla 3.6.3 Mozilla Bugzilla 3.6.2 Mozilla Bugzilla 3.6 Mozilla Bugzilla 3.4 rc1 Mozilla Bugzilla 3.4 Mozilla Bugzilla 3.2rc2 Mozilla Bugzilla 3.2rc1 Mozilla Bugzilla 3.2.9 Mozilla Bugzilla 3.2.8 Mozilla Bugzilla 3.2 Mozilla Bugzilla 2.22 RC1 Mozilla Bugzilla 2.22 Mozilla Bugzilla 2.20 Gentoo Linux Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64 |
| Not Vulnerable: |
Mozilla Bugzilla 4.1.3 Mozilla Bugzilla 4.0.2 Mozilla Bugzilla 3.6.6 Mozilla Bugzilla 3.4.12 |
Discussion
Bugzilla Multiple Security Vulnerabilities
Bugzilla is prone to the following vulnerabilities:
1. A security-bypass vulnerability.
2. An email header-injection vulnerability.
3. Multiple information-disclosure vulnerabilities.
4. Multiple cross-site scripting vulnerabilities.
Successfully exploiting these issues may allow an attacker to bypass certain security restrictions, obtain sensitive information, execute arbitrary script code in the browser of an unsuspecting user, steal cookie-based authentication credentials, and perform actions in the vulnerable application in the context of the victim.
Bugzilla is prone to the following vulnerabilities:
1. A security-bypass vulnerability.
2. An email header-injection vulnerability.
3. Multiple information-disclosure vulnerabilities.
4. Multiple cross-site scripting vulnerabilities.
Successfully exploiting these issues may allow an attacker to bypass certain security restrictions, obtain sensitive information, execute arbitrary script code in the browser of an unsuspecting user, steal cookie-based authentication credentials, and perform actions in the vulnerable application in the context of the victim.
Exploit / POC
Bugzilla Multiple Security Vulnerabilities
Attackers can use a browser to exploit these issues.
Attackers can use a browser to exploit these issues.
Solution / Fix
Bugzilla Multiple Security Vulnerabilities
Solution:
Updates are available. Please see the references for more information.
Solution:
Updates are available. Please see the references for more information.
References
Bugzilla Multiple Security Vulnerabilities
References:
References:
- Bugzilla Homepage (Mozilla)
- Security Advisory 4.1.2, 4.0.1, 3.6.5, and 3.4.11 (Mozilla)